Privacy Policy

Last updated: August 2026

1. Data Controller

The data controller responsible for the processing of your personal data is:

Legal business name: SONID SRL
Trading as: Red Chillies
Registered address: Leuvensesteenweg 265, 1932 Zaventem, Belgium
VAT number: BE 0784.724.753
Company registration number (BCE/KBO): 0784.724.753
Email: info@redchillies.com
Telephone: +32 2 479 10 67

For questions about this Privacy Policy or the processing of your personal data, please contact us using the details above.

2. Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Information You Provide to Us

Name (first name, last name);
Email address;
Telephone number;
Address (if provided for account or billing purposes);
Account information (if you create an account on our website);
Order details (items ordered, order preferences, dietary requirements you choose to share);
Payment-related information (your payment method and transaction reference — we do not store full card numbers);
Communication content (messages you send us via email, telephone, or contact forms);
Reservation details (date, time, number of guests, special requests).

2.2 Information Collected Automatically

IP address;
Browser type and version;
Operating system;
Device type (desktop, mobile, tablet);
Pages visited on our website and the duration of visits;
Referring website URL;
Cookie and similar technology data (please refer to our Cookie Policy for details).

3. Purpose of Processing and Legal Basis

We process your personal data for the following purposes and on the following legal bases under the General Data Protection Regulation (GDPR):

3.1 Order Fulfilment (Contract Performance — Art. 6(1)(b) GDPR)

Processing your name, contact details, and order information to prepare your food order and make it available for pickup/takeaway.

3.2 Payment Processing (Contract Performance — Art. 6(1)(b) GDPR)

Processing payment-related data to complete transactions for orders placed through our website. Payment processing is handled by our payment service provider; we do not store your full card details.

3.3 Customer Support (Contract Performance / Legitimate Interest — Art. 6(1)(b) and (f) GDPR)

Using your contact details and order information to respond to enquiries, complaints, refund requests, and other customer service communications.

3.4 Reservations (Contract Performance — Art. 6(1)(b) GDPR)

Processing your name, contact details, and reservation preferences to manage table reservations.

3.5 Legal and Accounting Obligations (Legal Obligation — Art. 6(1)(c) GDPR)

Retaining transaction records and related data as required by Belgian tax, accounting, and commercial law.

3.6 Marketing Communications (Consent — Art. 6(1)(a) GDPR)

Where you have given your explicit consent, we may send you promotional communications such as newsletters, special offers, or event invitations by email. You may withdraw your consent at any time by using the unsubscribe link in any marketing email, or by contacting us directly.

3.7 Website Improvement (Legitimate Interest — Art. 6(1)(f) GDPR)

Using technical data such as page views and device information to improve our website and user experience. We do not currently use third-party analytics services. See our Cookie Policy for details on the cookies used.

4. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

Order and transaction data: retained for the period required by Belgian tax and accounting law (currently 7 years for accounting records);
Customer account data: retained for as long as your account is active, and for a reasonable period thereafter to handle any outstanding enquiries;
Marketing consent records: retained for as long as you remain subscribed, plus a reasonable period to demonstrate that consent was given;
Customer support correspondence: retained for a reasonable period after the enquiry is resolved.

5. Third-Party Service Providers

We may share your personal data with the following categories of third-party service providers who assist us in operating our business and website:

Payment service providers — to process your payments securely;
Website hosting providers — to host and maintain our website;
Email service providers — to send order confirmations and, where consented, marketing communications.

These third parties process your data only on our behalf and in accordance with our instructions, under appropriate data processing agreements. We do not sell, trade, or rent your personal data to third parties.

6. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure that appropriate safeguards are in place, such as:

An adequacy decision by the European Commission;
Standard Contractual Clauses (SCCs) approved by the European Commission;
Other legally recognised transfer mechanisms under the GDPR.

You may request information about the safeguards in place by contacting us.

7. Your Rights Under the GDPR

As a data subject, you have the following rights under the General Data Protection Regulation:

Right of access — You have the right to request a copy of the personal data we hold about you.
Right to rectification — You have the right to request that we correct any inaccurate or incomplete personal data.
Right to erasure — You have the right to request deletion of your personal data, subject to legal retention obligations.
Right to restriction of processing — You have the right to request that we restrict the processing of your data in certain circumstances.
Right to object — You have the right to object to the processing of your personal data where we rely on legitimate interest as the legal basis.
Right to data portability — You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to withdraw consent — Where processing is based on your consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details provided in Section 1. We will respond to your request within one month, as required by the GDPR. In complex cases, this period may be extended by a further two months, in which case we will inform you.

8. Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR or applicable Belgian data protection law, you have the right to lodge a complaint with the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit):

Belgian Data Protection Authority
Rue de la Presse / Drukpersstraat 35
1000 Brussels, Belgium
Telephone: +32 (0)2 274 48 00
Email: contact@apd-gba.be
Website: www.dataprotectionauthority.be

9. Cookies

Our website uses cookies and similar technologies. For detailed information about the cookies we use, the purposes for which we use them, and how you can manage your cookie preferences, please refer to our Cookie Policy.

10. Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include:

Encrypted data transmission (SSL/TLS) on our website;
Secure payment processing through certified payment service providers;
Access controls limiting who within our organisation can access personal data;
Regular review and updating of our security practices.

While we take all reasonable precautions, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your data.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, legal requirements, or business operations. The updated version will be published on this page with a revised "last updated" date. Where changes are material, we may notify you by email or through a notice on our website.

12. Contact Information

For questions about this Privacy Policy or the processing of your personal data, please contact us:

Red Chillies
SONID SRL
Leuvensesteenweg 265
1932 Zaventem, Belgium
Email: info@redchillies.com
Telephone: +32 2 479 10 67